OrgTree — Privacy Policy

Effective date: 03 August 2026

Who we are: OrgTree Limited (9429053863171 / 9448239) ("OrgTree", "we", "us").

Privacy contact: admin@orgtree.co.nz

1. About this policy

This policy explains how we collect, use, store and share personal information when you use OrgTree at orgtree.co.nz (the "Service"), in accordance with the Privacy Act 2020 and its Information Privacy Principles (IPPs).

2. Scope

This policy covers: (a) personal information about you as a user; and (b) our handling of personal information about third parties (e.g. company directors and shareholders) that appears in register data you view through the Service (see section 6).

3. You can use OrgTree without an account

You can search and explore without signing in. We only ask you to create an account when you choose to save work to a profile.

4. Information we collect

4.1 Account information. If you sign in, we collect your email address, and — if you use Google sign-in — basic Google profile information (e.g. name, email) provided by Google. We do not collect or store passwords; sign-in is by one-time email code or Google OAuth.

4.2 Content you create. Notes, labels and custom elements you add to a canvas, and (if/when cloud save is enabled) the workspaces you save.

4.3 Usage and technical data. Basic technical information needed to run and secure the Service (e.g. general log and device/browser data).

4.4 Register data (third-party personal information). When you search the register, the Service displays information sourced from the New Zealand Companies Register and the New Zealand Business Number Register via MBIE, which can include the personal information of third parties such as directors' and shareholders' names and roles. We display this public register data to you at your request; we do not compile or retain independent profiles of those individuals beyond operating the Service and any workspace you choose to save.

5. How we use your information

We use your information to: (a) provide and operate the Service; (b) authenticate you and secure your account; (c) save and restore your workspaces (if enabled); (d) respond to your requests and provide support; (e) maintain security, prevent misuse and meet legal and audit obligations (including to MBIE); and (f) improve the Service. We do not sell your personal information.

6. Register data and individual privacy

6.1 Register data is public information published by the New Zealand Companies Register and the New Zealand Business Number Register. Your use of it through the Service must comply with the Privacy Act 2020 and our Terms of Use, and must not infringe any individual's privacy (for example, no unlawful profiling of individuals).

6.2 The Service does not display individuals' residential addresses. (New Zealand is strengthening director-address privacy under the Companies Address Information Amendment Act 2025, in force by 18 November 2026.)

6.3 If you're an individual on the register and have a concern about how data about you is displayed, contact us at admin@orgtree.co.nz; note the underlying record is held by the relevant New Zealand register.

7. Cookies and local storage

We use browser storage to keep you signed in and to hold your in-progress canvas locally (so a refresh doesn't lose your work). We don't use these for advertising.

8. Who we share information with

8.1 Service providers (processors) acting on our instructions:

Supabase — authentication and (when enabled) database storage of accounts and saved workspaces.
Google — where you choose Google sign-in.
Vercel — hosting of the Service.
MBIE — the source of register data; we may share information as needed to comply with our API agreement, including audit requests.

8.2 We may disclose information where required or permitted by law.

8.3 We don't sell personal information or share it for third-party advertising.

9. Storage, security and overseas transfer

9.1 We take reasonable steps to protect personal information. Access to saved data is restricted per-user by database row-level security, and API credentials are held server-side only.

9.2 Some providers store or process data outside New Zealand (for example, Supabase in Sydney, Australia, and Google/Vercel in various locations). By using the Service you acknowledge your information may be stored or processed overseas, protected by comparable safeguards or the provider's contractual commitments.

10. Retention

We keep your account and saved data while your account is active, and delete or de-identify it within a reasonable period after you delete your account or it becomes inactive, except where we must retain it to meet legal or audit obligations.

11. Your rights

Under the Privacy Act 2020 you can ask to access or correct the personal information we hold about you, and you can delete your account. To make a request, contact admin@orgtree.co.nz. We'll respond within the timeframes required by law.

12. Children

The Service isn't directed at children and isn't intended for use by anyone under the age of 16.

13. Complaints

If you're not satisfied with how we've handled your information, contact us first at admin@orgtree.co.nz. You may also complain to the Office of the Privacy Commissioner (privacy.org.nz).

14. Changes to this policy

We may update this policy from time to time; the effective date above shows the latest version, and material changes will be notified via the Service or by email.

15. Contact

OrgTree Limited — Privacy — admin@orgtree.co.nz